There could be circumstances in which a service auditor’s report is not available, the certifying officers do not have access to controls in place at the service organization and the certifying officers have not identified any compensating controls performed by the issuer. In these circumstances the inability to assess the service organization’s controls, policies and procedures might represent a material weakness since the certifying officers might not have sufficient evidence to conclude whether the components of the issuer’s ICFR at the service organization have been designed or are operating as intended.
